Page 1 of 1

False friend

Posted: Thu Sep 25, 2008 4:54 am
by Jubilee
email from friend according to learning filter is in fact spam.
no option to tick spam.
How do I teach the learning filter?

Re: False friend

Posted: Thu Sep 25, 2008 5:13 am
by AlphaCentauri
The purpose of a friends list is so no matter how spammy, emails from your friends won't be accidentally deleted as spam. So it's not necessary to teach the learning filters about them. If you want to report the spam to spamcop or FirstAlert, you have to remove the address from the friends list, report without deleting, put it back on the friends list, then delete.

If you have addresses on the friends list that get spoofed a lot, like ebay, it may be easier to create a filter that recognizes the address and also looks for confirmation like an IP address in the headers that corresponds to the sending server for that email address, and then put that filter ahead of any spam filters.

The most common case of spam trying to use your friends list to get past filters is spam that uses your own address in both the "from" and the "to" fields. You normally would want your own address on the friends list if you mail from more than one computer and sometimes mail things to yourself to transfer files from one computer to the other. Since I have a dynamic IP address, I can't use the IP address to create a filter to tell real mail I've sent myself from spoofed stuff.

So in my email client, I have set up the preferences to include text in the "organization" line. I have the same text in the preferences on all my computers. It can be a real organization that goes with the email address, or just an easy-to-remember code number (like some phone number you know well but that no one else would associate with you, for instance). Then you can create a filter that says that any email that has your email address in the "from" line, but does not have that exact string of text/code in the complete headers, is spam.

Re: False friend

Posted: Thu Sep 25, 2008 5:18 am
by Jubilee
yes
but he is not a friend or known to me
he has been identified as one by the learning filter
he is selling viagra

Re: False friend

Posted: Thu Sep 25, 2008 5:49 am
by stan_qaz
The learning filter does not have any connection to the Friends list, Friends is a separate tool.

I think we have a basic confusion here, what does the status column say?

Is there a tick mark in the Friends column?

Are you using the action or learning columns, if so what do they say?

Re: False friend

Posted: Thu Sep 25, 2008 5:54 am
by AlphaCentauri
Jubilee wrote:yes
but he is not a friend or known to me
he has been identified as one by the learning filter
he is selling viagra
You should have a column for items in your inbox that says, "From." Look in that space for the email from the "false friend." It may have anybody's name on it. But what counts is the email address.

Suppose you have a friend named Joe Smith, and his email address is jsmith@yahoo.com
Now, if an email arrives that has a "from" line that says "James Smith <jsmith@yahoo.com>" Mailwasher is going to list it as a friend, since the email address matches, even if the name doesn't. You can see your friends list by clicking the clipboard called "settings" at the top of the MWP inbox, then under "spam tools" on the left, choose "my friends list." In this imaginary instance, you would either see an entry for jsmith@yahoo.com, or else a "wild card," like "*@yahoo.com" or "jsmith@*.com."

Now, what is listed in the "from" has nothing to do with who sent it. Spammers put fake information there. So sometimes they just get lucky and use an email address that is on your friends list. So for the rare lucky guess, don't worry about that one email. But for email addresses they will use a lot, like your own, you want to use a filter instead of the friends list to keep good emails from being marked as spam without the spam emails getting allowed through. You would create a filter, then unclick the box next to the item on your friends list so it stops overriding the filters.

Re: False friend

Posted: Thu Sep 25, 2008 7:08 am
by Jubilee
action is blank
spam is blank
status is friend - determined by learning filter
from email address is not in my friends list

Re: False friend

Posted: Thu Sep 25, 2008 7:24 am
by AlphaCentauri
Jubilee wrote:action is blank
spam is blank
status is friend - determined by learning filter
from email address is not in my friends list
If you look at the email in source view (click the icon that looks like a piece of paper with "< >" on it, just above the message preview window) it will show you the headers. Even if the email is blank, there will be some rudimentary headers or it couldn't have been delivered. If you copy whatever that says and send it to me in a private message (click the little square that says "PM" under my avatar to the left of this message), I can look at it and tell more about why it might have been called a "friend."

Re: False friend

Posted: Thu Sep 25, 2008 7:30 am
by stan_qaz
This one stumps me, I've never seen that status message.

Re: False friend

Posted: Thu Sep 25, 2008 11:51 am
by rusticdog
Jubilee wrote:action is blank
spam is blank
status is friend - determined by learning filter
from email address is not in my friends list
If the Status reads Friend, then the address will be in the Friends List somewhere. If you trained a message as Good, then the address is also added to your friends list. To get around this you will need to remove the address from your Friends list and retrain the message as bad.

Re: False friend

Posted: Fri Sep 26, 2008 8:29 am
by Jubilee
You are absolutely right.
I found it was getting through because of a wildcard expression.
I am now thoroughly embarrassed.
Thank you

Re: False friend

Posted: Fri Sep 26, 2008 8:54 am
by rusticdog
no need to feel embarrassed....we all make mistakes

the other day was quite cold, I ended up throwing my jeans on over my PJs....later that night before bed I searched around for about 40 minutes trying to find my PJ bottoms....wait, what?.....sorry too much information...

Re: False friend

Posted: Fri Sep 26, 2008 8:56 am
by AlphaCentauri
Jubilee wrote:You are absolutely right.
I found it was getting through because of a wildcard expression.
I am now thoroughly embarrassed.
Thank you
You don't learn anything when you get it right the first time.

Now you can help someone else who has the same problem. How do you think I knew where to look?